diff --git a/ares_init.c b/ares_init.c
index dffa518171b29cf5af3849664854fb1b827c3c0e..94855c13c692d41d6f84eda295565a92a62cc94a 100644
--- a/ares_init.c
+++ b/ares_init.c
@@ -2210,6 +2210,9 @@ static int config_sortlist(struct apattern **sortlist, int *nsort,
       q = str;
       while (*q && *q != '/' && *q != ';' && !ISSPACE(*q))
         q++;
+      if (q - str >= 16) {
+        return ARES_EBADSTR;
+      }
       memcpy(ipbuf, str, q-str);
       ipbuf[q-str] = '\0';
       /* Find the prefix */
@@ -2218,6 +2221,9 @@ static int config_sortlist(struct apattern **sortlist, int *nsort,
           const char *str2 = q+1;
           while (*q && *q != ';' && !ISSPACE(*q))
             q++;
+          if (q - str >= 32) {
+            return ARES_EBADSTR;
+          }
           memcpy(ipbufpfx, str, q-str);
           ipbufpfx[q-str] = '\0';
           str = str2;
diff --git a/test/ares-test-init.cc b/test/ares-test-init.cc
index ff6c6c6e02f2a0e9d2e92f6d7414b54e9a534a2c..c3cb9488dd3d1002827d645eac578be96690d87a 100644
--- a/test/ares-test-init.cc
+++ b/test/ares-test-init.cc
@@ -270,6 +270,8 @@ TEST_F(DefaultChannelTest, SetAddresses) {
 
 TEST_F(DefaultChannelTest, SetSortlistFailures) {
   EXPECT_EQ(ARES_ENODATA, ares_set_sortlist(nullptr, "1.2.3.4"));
+  EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111*/16"));
+  EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111/255.255.255.240*"));
   EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; lwk"));
   EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; 0x123"));
 }